This sounds very clever. #cososec

"When you create a DNS based Canarytoken, the system gives you a unique Internet resolvable domain name.

Anyone attempting to resolve this domain name, will now trigger an alert.

Why does this matter? Once you are able to get an alert for a web-based token, or a DNS based token, you have the building blocks for squillions of possible tripwires."

DNS Token | Canarytokens
https://docs.canarytokens.org/guide/dns-token.html#what-is-a-dns-token